Hardware Accelerator for Malware Emulation Speed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware emulators are inefficient in detecting malware due to slow processing speeds, particularly when faced with dummy loops and calculation-intensive processes, which can lead to undetected malware components.
Innovation Solution
A hardware accelerator is implemented to execute potentially malicious processes on a real CPU, with a dedicated memory area for emulation, allowing the emulator to restore its state and terminate processes that exceed memory boundaries, thereby accelerating the emulation process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a software-based emulator is used to ensure isolation and security, then malware detection reliability is improved, but processing speed deteriorates significantly
Solution Approach 1:
The system segments the emulation process into two distinct parts: a hardware-based accelerator for executing dummy loops and calculation-intensive processes, and a software-based emulator for handling malicious code detection. This segmentation allows each component to operate in its optimal environment, with the hardware accelerator providing fast execution and the software emulator providing secure isolation and detection capabilities.
Solution Approach 2:
A communication interface acts as an intermediary between the hardware accelerator and the software emulator. This intermediary enables data transfer and coordination between the two systems, allowing the hardware accelerator to quickly process instructions and return results to the emulator for analysis, thereby maintaining both speed and reliability.
2Measurement precision
If the emulator executes all instructions to ensure complete analysis, then detection accuracy is improved, but execution time increases to several minutes
Solution Approach 1:
The system extracts and isolates dummy loops and calculation-intensive processes from the main malware execution flow. By identifying these non-malicious but time-consuming processes and executing them separately on the hardware accelerator, the system eliminates unnecessary delays while preserving the ability to detect actual malicious behavior in the remaining code.
Solution Approach 2:
The system performs preliminary analysis to identify dummy loops and calculation-intensive processes before they can consume excessive emulator resources. By detecting and extracting these processes in advance, the system prevents them from slowing down the overall emulation process while maintaining complete detection coverage.
3Reliability
If dummy loops are executed completely to maintain emulation integrity, then analysis completeness is improved, but productivity deteriorates due to resource consumption
Solution Approach 1:
The system implements a mechanism to skip over dummy loops by detecting their characteristic patterns and transferring their execution to the hardware accelerator. This allows the software emulator to quickly bypass these non-malicious processes without compromising analysis completeness, as the hardware accelerator continues to execute and monitor these loops in parallel.
Solution Approach 2:
The system changes the execution parameters of dummy loops by running them on different hardware (the accelerator instead of the emulator) with different performance characteristics. This parameter change allows the same code to be executed with vastly improved speed while maintaining the same analytical value for detecting malicious behavior.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for accelerating malware emulator by using an accelerator. The accelerator allows for a potentially malicious component (i.e., process) containing dummy processes to be executed in a real CPU of a computer system using its operating memory. A special memory area is allocated for the process based on the memory requested by the process in the emulator. The state of the CPU and the memory is loaded in the emulator prior to executing the suspicious process. The system can be restored to its initial state in case of malicious actions performed by the process. The dummy instructions of the process are processed by the CPU at its own speed and as soon as the process performs a malicious instruction it is stopped by the emulator. The emulation process is accelerated to a speed of a regular CPU.